Patch Node.js vulnerabilities

Patches the selected Node.js vulnerabilities by updating the affected package versions in package.json and opening a GitHub pull request in the connected repository.

Patch Node.js vulnerabilities

post

Patches the selected Node.js vulnerabilities by updating the affected package versions in package.json and opening a GitHub pull request in the connected repository. The customer reviews and merges the pull request; merging triggers the automatic deployment.

Auto-fix is only available for websites deployed from a connected GitHub repository. Websites deployed from an archive have no auto-fix path and return a 404. The Hostinger GitHub App needs write access to the repository; without it the request fails with a 403 explaining the missing permission.

Only vulnerabilities with is_patchable set to true can be patched. Non-patchable IDs in the selection are skipped; the pull request covers the patchable subset, listed in patched_vulnerability_ids. Selections without any patchable vulnerability are rejected with a 422. Only one patch pull request can be open at a time per website; close or merge it before patching again. Available on Business and Cloud Hosting plans.

Authorizations

AuthorizationstringRequired

API Token authentication

Path parameters

usernamestringRequiredExample: u123456789

domainstringRequired

Domain name

Example: mydomain.tld

Body

vulnerability_idsstring[] · min: 1Required

List of vulnerability IDs to patch, as returned by the list vulnerabilities endpoint.

Example: GHSA-1111-2222-3333

Responses

201

Created response

application/json

pr_urlstringOptional

URL to the created GitHub pull request

Example: https://github.com/owner/repo/pull/42

pr_numberintegerOptional

GitHub pull request number

Example: 42

head_branchstringOptional

The branch created with the fix

Example: fix/patch-vulnerabilities-a1b2c3d4

patched_vulnerability_idsstring[]Optional

List of vulnerability IDs that were patched in the pull request

Example: ["GHSA-jf85-cpcp-j695"]

401

Unauthenticated response

application/json

422

Validation error response

application/json

500

Error response

application/json

post/api/hosting/v1/accounts/{username}/websites/{domain}/nodejs/vulnerabilities/patch

POST /api/hosting/v1/accounts/{username}/websites/{domain}/nodejs/vulnerabilities/patch HTTP/1.1
Host: developers.hostinger.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 45

{
  "vulnerability_ids": [
    "GHSA-1111-2222-3333"
  ]
}

{
  "pr_url": "https://github.com/owner/repo/pull/42",
  "pr_number": 42,
  "head_branch": "fix/patch-vulnerabilities-a1b2c3d4",
  "patched_vulnerability_ids": [
    "GHSA-jf85-cpcp-j695"
  ]
}